Skip to content

Commit ee95d80

Browse files
ciaranraciaranra
authored
CI/supply-chain security hardening (#316)
* Drop stray planning reference from pyproject test-dependency comment * Add SHA-pinned step-security/harden-runner (egress audit) as the first step of every CI job * Document IoC-list maintenance/refresh process in dependency-integrity-check * Dependency hygiene: add Dependabot gomod coverage and pin a non-vulnerable Pillow floor in docs * Drain Go stdlib advisories: bump go/pecos go directive 1.18 -> 1.26.3 (stdlib-only module, no deps)
1 parent f559e60 commit ee95d80

24 files changed

Lines changed: 217 additions & 2 deletions

‎.github/dependabot.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,3 +62,18 @@ updates:
6262
ignore:
6363
- dependency-name: "*"
6464
update-types: ["version-update:semver-patch", "version-update:semver-minor", "version-update:semver-major"]
65+
66+
# Go (gomod) - security updates only. Watches the Go module that was
67+
# previously uncovered (its transitive tree had accumulated advisories).
68+
- package-ecosystem: "gomod"
69+
directory: "/go/pecos"
70+
schedule:
71+
interval: "weekly"
72+
open-pull-requests-limit: 5
73+
groups:
74+
go-security:
75+
applies-to: security-updates
76+
patterns: ["*"]
77+
ignore:
78+
- dependency-name: "*"
79+
update-types: ["version-update:semver-patch", "version-update:semver-minor", "version-update:semver-major"]

‎.github/workflows/cargo-deny.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,11 @@ jobs:
3535
runs-on: ubuntu-latest
3636
timeout-minutes: 30
3737
steps:
38+
- name: Harden the runner (egress audit)
39+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
40+
with:
41+
egress-policy: audit
42+
3843
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3944
with:
4045
persist-credentials: false

‎.github/workflows/codeql.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,11 @@ jobs:
4040
build-mode: none
4141

4242
steps:
43+
- name: Harden the runner (egress audit)
44+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
45+
with:
46+
egress-policy: audit
47+
4348
- name: Checkout repository
4449
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
4550
with:

‎.github/workflows/cuda-build-check.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,11 @@ jobs:
3535
cuda-build-check:
3636
runs-on: ubuntu-latest
3737
steps:
38+
- name: Harden the runner (egress audit)
39+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
40+
with:
41+
egress-policy: audit
42+
3843
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3944
with:
4045
persist-credentials: false
@@ -104,6 +109,11 @@ jobs:
104109
cuda-testing-info:
105110
runs-on: ubuntu-latest
106111
steps:
112+
- name: Harden the runner (egress audit)
113+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
114+
with:
115+
egress-policy: audit
116+
107117
- name: CUDA Testing Requirements
108118
run: |
109119
echo "=============================================="

‎.github/workflows/dependency-integrity-check.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,11 @@ jobs:
2525
runs-on: ubuntu-latest
2626
timeout-minutes: 15
2727
steps:
28+
- name: Harden the runner (egress audit)
29+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
30+
with:
31+
egress-policy: audit
32+
2833
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2934
with:
3035
persist-credentials: false

‎.github/workflows/dependency-review.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,11 @@ jobs:
5454
runs-on: ubuntu-latest
5555
timeout-minutes: 10
5656
steps:
57+
- name: Harden the runner (egress audit)
58+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
59+
with:
60+
egress-policy: audit
61+
5762
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
5863
with:
5964
persist-credentials: false

‎.github/workflows/github-actions-security.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,11 @@ jobs:
3939
contents: read
4040
actions: read
4141
steps:
42+
- name: Harden the runner (egress audit)
43+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
44+
with:
45+
egress-policy: audit
46+
4247
- name: Checkout repository
4348
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
4449
with:

‎.github/workflows/go-test.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,12 @@ jobs:
4444
go-version: ["stable"] # Latest stable (experimental bindings)
4545

4646
steps:
47+
- name: Harden the runner (egress audit)
48+
if: runner.os == 'Linux'
49+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
50+
with:
51+
egress-policy: audit
52+
4753
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
4854
with:
4955
persist-credentials: false

‎.github/workflows/go-version-consistency.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,11 @@ jobs:
2525
check-go-versions:
2626
runs-on: ubuntu-latest
2727
steps:
28+
- name: Harden the runner (egress audit)
29+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
30+
with:
31+
egress-policy: audit
32+
2833
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2934
with:
3035
persist-credentials: false

‎.github/workflows/julia-release.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,11 @@ jobs:
6060
outputs:
6161
run: ${{ steps.check.outputs.run }}
6262
steps:
63+
- name: Harden the runner (egress audit)
64+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
65+
with:
66+
egress-policy: audit
67+
6368
- name: Check if should run on PR push
6469
id: check
6570
env:
@@ -104,6 +109,12 @@ jobs:
104109
architecture: x86_64
105110

106111
steps:
112+
- name: Harden the runner (egress audit)
113+
if: runner.os == 'Linux'
114+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
115+
with:
116+
egress-policy: audit
117+
107118
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
108119
with:
109120
persist-credentials: false
@@ -267,6 +278,12 @@ jobs:
267278
os: macos-latest
268279
architecture: aarch64
269280
steps:
281+
- name: Harden the runner (egress audit)
282+
if: runner.os == 'Linux'
283+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
284+
with:
285+
egress-policy: audit
286+
270287
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
271288
with:
272289
persist-credentials: false
@@ -346,6 +363,11 @@ jobs:
346363
needs.test_binaries.result == 'success'
347364
runs-on: ubuntu-latest
348365
steps:
366+
- name: Harden the runner (egress audit)
367+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
368+
with:
369+
egress-policy: audit
370+
349371
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
350372
with:
351373
persist-credentials: false
@@ -475,6 +497,11 @@ jobs:
475497
needs.test_binaries.result == 'success'
476498
runs-on: ubuntu-latest
477499
steps:
500+
- name: Harden the runner (egress audit)
501+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
502+
with:
503+
egress-policy: audit
504+
478505
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
479506
with:
480507
ref: ${{ inputs.sha || github.sha }}

0 commit comments

Comments
 (0)